Most recent entries from all

ALSA-2025:3261 — Moderate: nginx:1.22 security update

Affected: AlmaLinux:9: nginx, AlmaLinux:9: nginx-all-modules, AlmaLinux:9: nginx-core, AlmaLinux:9: nginx-filesystem, AlmaLinux:9: nginx-mod-devel, AlmaLinux:9: nginx-mod-http-image-filter, AlmaLinux:9: nginx-mod-http-perl, AlmaLinux:9: nginx-mod-http-xslt-filter, AlmaLinux:9: nginx-mod-mail, AlmaLinux:9: nginx-mod-stream

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

* nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-06605

BELL-CVE-2024-7347

Affected: Alpaquita:23: nginx, Alpaquita:stream: nginx

BIT-nginx-2024-7347 — NGINX MP4 module vulnerability

Affected: Bitnami: nginx

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

certfr-2024-avi-0699 — De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant…

certfr-2024-avi-0699

Withdrawn: CLEANSTART-2026-AF45008 — When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumptio…

Withdrawn by the publisher.

Affected: CleanStart: nginx

Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerability details.

EUVD-2026-258208

fkie_cve-2024-7347

GHSA-3r23-64c4-mj87

msrc_CVE-2024-7347 — NGINX MP4 module vulnerability

msrc_CVE-2024-7347

OESA-2024-2065 — nginx security update

Affected: openEuler:22.03-LTS-SP4: nginx

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fix(es): NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2024-7347)

openSUSE-SU-2024:14271-1 — nginx-1.27.1-1.1 on GA media

nginx-1.27.1-1.1 on GA media

RHSA-2025:7542 — Red Hat Security Advisory: nginx:1.24 security update

nginx: specially crafted MP4 file may cause denial of service

SUSE-SU-2025:0283-1 — Security update for nginx

Security update for nginx

UBUNTU-CVE-2024-7347

Affected: Ubuntu:Pro:14.04:LTS: nginx, Ubuntu:Pro:16.04:LTS: nginx, Ubuntu:Pro:18.04:LTS: nginx, Ubuntu:20.04:LTS: nginx, Ubuntu:22.04:LTS: nginx, Ubuntu:24.04:LTS: nginx

WID-SEC-W-2024-1863 — NGINX und NGINX Plus: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer oder ein lokaler Angreifer kann mehrere Schwachstellen in NGINX NGINX Plus und NGINX ausnutzen, um einen Denial of Service Angriff durchzuführen.